An improper neutralization of input during web page generation in the WordPress Send to a Friend Addon allows reflected XSS. This flaw can allow an attacker to inject malicious JavaScript into a page viewed by a victim, potentially enabling cookie theft, session hijacking, or other client‑side attacks. The vulnerability aligns with CWE‑79.

The flaw exists in the WordPress plugin pinal.shah Send to a Friend Addon, versions up to and including 1.4.1, which can be installed on any WordPress site that uses this plugin.

With a CVSS score of 7.1 the vulnerability is considered high severity, yet the EPSS score of less than 1% indicates a low probability of exploitation as of the current data. It is not listed in the CISA KEV catalog. The likely attack vector is via a crafted URL or form submission that triggers the plugin’s unsanitized echo of user input. An attacker would need to entice or trick a user to visit such a link or fill the form; no privileged access or additional conditions are required.